This comes shortly after researchers working for Kyrus Technology released a blog post detailing how CryptoLocker works, as well as how they reverse engineered it to acquire the private key used to encrypt hundreds of thousands of files.

The CryptoLocker trojan was first discovered by Dell SecureWorks last September. It works by encrypting files that have specific file extensions, and only decrypting them once a ransom of $300 had been paid.

Although the network that served the Trojan was eventually taken down, thousands of users remain separated from their files. Until now.

Have you been hit by Cryptolocker? Want to know how you can get your files back? Read on for more info.

It didn’t just attack local hard drives, either. If there was an external hard drive or a mapped network drive connected to an infected computer, it too would be attacked. This caused havoc in businesses where employees often collaborate and share documents on network attached storage drives.

The virulent spread of CryptoLocker was also something to behold, as was the phenomenal amount of money it pulled in. Estimates range from $3m to a staggering $27m, as victims paid the ransom that was demanded en-masse, eager to get their files back.

Not long after, the servers used to serve and control the Cryptolocker malware were taken down in ‘Operational Tovar‘, and a database of victims was recovered. This was the combined efforts of police forces from multiple countries, including the US, the UK, and most European countries, and saw the ringleader of the gang behind the malware indicted by the FBI.

Which brings us to today. CryptoLocker is officially dead and buried, although many people are unable to get access to their seized files, especially after the payment and control servers were taken down as part of Operation Server.

But there’s still hope. Here’s how CryptoLocker was reversed, and how you can get your files back.

How Cryptolocker Was Reversed

Files encrypted with the CryptoLocker malware follow a specific format. Each encrypted file is done with an AES-256 key that is unique to that particular file. This encryption key is then subsequently encrypted with a public/private key pair, using a stronger near-impervious RSA-2048 algorithm.

The public key generated is unique to your computer, not the encrypted file. This information, in conjunction with an understanding of the file format used to store encrypted files meant that Kyrus Technologies were able to create an effective decryption tool.

But there was one problem. Although there was a tool to decrypt files, it was useless without the private encryption keys. As a result, the only way to unlock a file encrypted with CryptoLocker was with the private key.

Thankfully, FireEye and Fox-IT has acquired a significant proportion of the Cryptolocker private keys. Details about how they managed this are thin on the ground; they simply say they got them through ‘various partnerships and reverse engineering engagements’.

This library of private keys and the decryption program created by Kyrus Technologies means that victims of CryptoLocker now have a way to get their files back, and at no cost to them. But how do you use it?

Decrypting A CryptoLocker Infected Hard Drive

First, browse to decryptcryptolocker.com. You’re going to need a sample file that has been encrypted with the Cryptolocker malware to hand.

Then, upload it to the DecryptCryptoLocker website. This will be then be processed, and (hopefully) return the private key associated with the file which will then be emailed to you.

Then, it’s a matter of downloading and running a small executable. This runs on the command line, and requires that you specify the files you wish to decrypt, as well as your private key. The command to run it is:

Decryptolocker.exe –key “<key>” <Lockedfile.doc>

Just to re-iterate – This won’t automatically run on every affected file. You’ll need to either script this with Powershell or a Batch file, or run it manually on a file-by-file basis.

So, What’s The Bad News?

It’s not all good news though. There are a number of new variants of CryptoLocker that continue to circulate. Although they operate in a similar fashion to CryptoLocker, there’s no fix for them yet, other than paying the ransom.

More bad news. If you’ve already paid the ransom, you’re probably never going to see that money ever again. Although there have been some excellent efforts made at dismantling the CryptoLocker network, none of the money earned from the malware has been recovered.

There’s another, more pertinent lesson to be learned here. A lot of people made the decision to wipe their hard drives and start afresh rather than pay the ransom. This is understandable. However, these people will not be able to take advantage of DeCryptoLocker to recover their files.

Your email address will not be published. Required fields are marked *

Comment

Name *

Email *

John

March 27, 2017 at 4:34 am

Dear Sir/Madam,

My wife has Alzheimer and I had to take over her computer computer all tax information was in Excel format. If that was not enough. I am a Pilot and I fly rescue Animals from Bad homes to Good homes. I fly for Pilots N Paws and the service is free and I had lots of photos to show families what they could expect. Needless to say the Hacker lockeded them

Thanks a lot for your informative article. I was hit by this cryptolocker and I sent the laptop to our IT headquarter and they couldnt do any thing about it Im afraid.
SO Im stuck with finding out myself if there is a possibility to get my fies back without paying aa fortune for it. I tried to access the decryptolocker website but the link was dead.

If the key would be sent to the owner from my private LAN network, is there any way to take it over?
I mean , how it's look like for my home router? If someone using sniffer and save logs from all traffic is there a possibility to transform logs into rainbow tables ?
If I recover some deleted files and try to do some dictionary attack on encrypted file and compare the healthy checksums with result of decoding is there any possibility to make it?

My name is Taft David Haynes my email is taftdavidhaynes@hotmail.com if you have any information that can help me please email me. I had just a few corrupted jpeg images. I did a search and found a jpeg repair download. I can't remember the name of it, but I know that is how I got the cryptolocker virus. My malewarebytes antimaleware software tried to warn me, it siad the download was suspicious, it didn't say dangerous or harmjust suspicious. So i made the mistake of ignoring my warning. Big, Big, Big mistake. I had download the cryptolocker virus. It even told me its name, and it titled many of my files as Cryptolocker. I found the fire eye website. I uploaded a file to them at decryptcryptolocker.com However after it scanned the file it said I didnot have the cryptolocker virus. All my personal files re encrypted. Also on thousands and thousands of non personal files it says HELP RESTORE FILE all throught just about every program every file every where on my system. I ran my malewarebytes program and my laptop works but still need help.

hi
recently in may 2015 i got hit by cryptolocker
all my files are encrypted now
i don't have any backup to my files
i uploaded encrypted files to decryptolocker but it says , "The file does not seem to be infected by CryptoLocker. Please submit a CryptoLocker infected file"
please somebody help
i really need tose files
my email id is sourabh.trehan22@gmail.com

Unfortunately my data have been infected through an email hastly opened :( Instructions in txt messages added to any folder i have said it was an RSA-2048 Cryptoloker. I tried to upload my files to get my unique key, byt site doesn't recognizes and says "thi is not a cryptolocker infected file" :(

We are fairly certain that our infection came from an email that an office girl opened in haste. Other than the OS, everything is un useable. Our file extensions have not been changed though and we can even open documents but they are un readable. I tried to upload several to the Decryptolocker site but it says is not infected with Cryptolocker. I think we have a new starin of it.

Hit very badly, all files which could be encrypted, have been, and am just not able to decrypt files: tried FireEye, Panda, decrypt_dblblock, rannohdecryptor.exe. Now what? Infact I dont even know which specific virus has hit since the files names stay the same as original and do not get appended by anything, and on the desktop there is no html with the list of affected files.

John, I was also hit this week with what seems to be Cryptolocker - same file extension "exx" added to the end of each file. I have a USB backup with all my photos and video files, but have not checked it yet to see if it was also infected. I have critical Excel and Word files etc... that I'm certain are encrypted, but were not backed up. I am not 100% sure how to first remove the virus from the Registry entries etc... I understand there may be a registry variable that keeps a list of the infected files by name. If the virus is removed, does the list of infected files go away. I shut my computer down when it was using 100% of the CPU power. I tried to right click to get Task manager up to see what was going on, but it wouldn't load. I am now concerned about starting the computer again and having the virus kick off and encrypt more files. I understand it may even run in "Safe Mode". I never saw the Red box alert, but I did restart my computer once thinking it would stop whatever had been running, and I got a text box message similar to Notepad on my Desktop with essentially the same message that others received via the wallpaper. It said I was hit with high end encryption RSA-2048 and requested 2 bitcoins. It also mentioned something about a Tor Browser.

It would be helpful if someone could outline the steps to removing the virus (Win 7 Pro). I understand Malwarebytes may remove it, but there are so many versions - Free, Premium - not sure which to use. I am running McAfee Total Protection, but that doesn't seem to have saved me from this demon.

Also I had a USB drive attached to my desktop (for backup) I don't know if any files were impacted yet. I am concerned about attaching it to my laptop. If files were encrytped, is there a way for it to spread to my laptop? Can I protect my laptop before attaching the USB drive to it to look at the files?

Proposed steps for recovery: (please submit your suggestions)
1- download software to remove virus (which one?) 2- copy all untouched files to a new clean USB drive 3- look for shadow files of encrypted files 4- upload an encryted file to the FireEye Fox IT site to see if there is a key available to decrypt my files.

For the record I am embarrassed to say I received a pop-up that was a Microsoft Install message. Stating Microsoft needed to update "something", I clicked on no about 12 times, and it wouldn't go way. The red X in the top corner didn't work either. I clicked on the link to check the security certificate, and it had a simple tree of three layers stating everything was certified and up to date by Microsoft. Finally I got fed up and clicked Yes to install/update - a decision I will regret for some time....

John, I was also hit this week with what seems to be Cryptolocker - same file extension "exx" added to the end of each file. I have a USB backup with all my photos and video files, but have not checked it yet to see if it was also infected. I have critical Excel and Word files etc... that I'm certain are encrypted, but were not backed up. I am not 100% sure how to first remove the virus from the Registry entries etc... I understand there may be a registry variable that keeps a list of the infected files by name. If the virus is removed, does the list of infected files go away. I shut my computer down when it was using 100% of the CPU power. I tried to right click to get Task manager up to see what was going on, but it wouldn't load. I am now concerned about starting the computer again and having the virus kick off and encrypt more files. I understand it may even run in "Safe Mode". I never saw the Red box alert, but I did restart my computer once thinking it would stop whatever had been running, and I got a text box message similar to Notepad on my Desktop with essentially the same message that others received via the wallpaper. It said I was hit with high end encryption RSA-2048 and requested 2 bitcoins. It also mentioned something about a Tor Browser.

It would be helpful if someone could outline the steps to removing the virus (Win 7 Pro). I understand Malwarebytes may remove it, but there are so many versions - Free, Premium - not sure which to use. I am running McAfee Total Protection, but that doesn't seem to have saved me from this demon.

Also I had a USB drive attached to my desktop (for backup) I don't know if any files were impacted yet. I am concerned about attaching it to my laptop. If files were encrytped, is there a way for it to spread to my laptop? Can I protect my laptop before attaching the USB drive to it to look at the files?

Proposed steps for recovery: (please submit your suggestions)
1- download software to remove virus (which one?) 2- copy all untouched files to a new clean USB drive 3- look for shadow files of encrypted files 4- upload an encryted file to the FireEye Fox IT site to see if there is a key available to decrypt my files.

For the record I am embarrassed to say I received a pop-up that was a Microsoft Install message. Stating Microsoft needed to update "something", I clicked on no about 12 times, and it wouldn't go way. The red X in the top corner didn't work either. I clicked on the link to check the security certificate, and it had a simple tree of three layers stating everything was certified and up to date by Microsoft. Finally I got fed up and clicked Yes to install/update - a decision I will regret for some time....

John, I was also hit this week with what seems to be Cryptolocker - same file extension "exx" added to the end of each file. I have a USB backup with all my photos and video files, but have not checked it yet to see if it was also infected. I have critical Excel and Word files etc... that I'm certain are encrypted, but were not backed up. I am not 100% sure how to first remove the virus from the Registry entries etc... I understand there may be a registry variable that keeps a list of the infected files by name. If the virus is removed, does the list of infected files go away. I shut my computer down when it was using 100% of the CPU power. I tried to right click to get Task manager up to see what was going on, but it wouldn't load. I am now concerned about starting the computer again and having the virus kick off and encrypt more files. I understand it may even run in "Safe Mode". I never saw the Red box alert, but I did restart my computer once thinking it would stop whatever had been running, and I got a text box message similar to Notepad on my Desktop with essentially the same message that others received via the wallpaper. It said I was hit with high end encryption RSA-2048 and requested 2 bitcoins. It also mentioned something about a Tor Browser.

It would be helpful if someone could outline the steps to removing the virus (Win 7 Pro). I understand Malwarebytes may remove it, but there are so many versions - Free, Premium - not sure which to use. I am running McAfee Total Protection, but that doesn't seem to have saved me from this demon.

Also I had a USB drive attached to my desktop (for backup) I don't know if any files were impacted yet. I am concerned about attaching it to my laptop. If files were encrytped, is there a way for it to spread to my laptop? Can I protect my laptop before attaching the USB drive to it to look at the files?

Proposed steps for recovery: (please submit your suggestions)
1- download software to remove virus (which one?) 2- copy all untouched files to a new clean USB drive 3- look for shadow files of encrypted files 4- upload an encryted file to the FireEye Fox IT site to see if there is a key available to decrypt my files.

For the record I am embarrassed to say I received a pop-up that was a Microsoft Install message. Stating Microsoft needed to update "something", I clicked on no about 12 times, and it wouldn't go way. The red X in the top corner didn't work either. I clicked on the link to check the security certificate, and it had a simple tree of three layers stating everything was certified and up to date by Microsoft. Finally I got fed up and clicked Yes to install/update - a decision I will regret for some time....

My computer would not go on the internet, so I took it back to Best Buy, it was still under warranty. They said it was infected with Cryptolocker, and that was why it wouldn't go on the internet. All of my other devices work off of the modem and wi-fi, so it is just the one computer. If it is Cryptolocker, how do I fix if I can't get on the net?David

Hey I got hit with cyberlocker last week and I just found out like today 5.4.15. I was not aware of it. It gave me a ransom to pay with in 72 hours or so. Since it have been over 72 hours. I lost all of my files. What can I do to get it back. Help.... I hope the programer of the virus would be killed soon.

Hi!
Got hit after (by error) opening zip file in below mail with title "your account xxxx has been banned". This implied that most files on local hard drives and USB drives were encrypted and renamed with extension ylvkmsk.
Fortunately the backup file on USB was not encrypted, so lesson learned here is that USB should only be mounted during backup!

im getting the same problem. every file i try to submit says "The file does not seem to be infected by CryptoLocker. Please submit a CryptoLocker infected file." i found a scan tool that supposedly scans foldes for files that are possibly encryted but i still havent had any luck getting FireEye to help me at all.

Client computer came in with this issue, must be another variant because I too am getting the "this file isn’t infected by cryptolocker" on the two jpgs I uploaded. rename to just jpg gives me a thumbnail, but no more. Killing the thing is the easy part and most times I've seen it it only got as far as changing the background..... Fun thing is they use XP (SP3) and no restore points, so no shadow copy.

I don't know if it is Cryptolocker but I have been infected by a ransom virus that added ".VOIGRZK" to all .xls, .doc, .jpg, .ppt files and encrypted them so they can't be used. I contacted McAfee who connected me to Live PC Geeks who spent 2 days messing with my system only to end up with a PC that could no longer be booted and no usable data files. I added a new HDD and moved the infected disk to D: so I can still try to get the files back but no luck so far.
I tried to send a sample file to fireeye but the upload screen just stays at the "...please wait..." screen and doesn't seem to work.
Any thoughts?

hi guys, last year i encrypted my ADATA HD650 External hdd by windows 8 bit-locker, and recently i decided to decryption my ADATA HD650 External hdd, to use in old windows XP, first i removed bit-locker password, after In %91 of decryption i paused the decryption, and when i attached it again to continue the decryption, my windows 10 doesn't know hard disk and shows "access is denied"
what should i do? i need my Projects :( 600 GB sos pls

I got hot by ctb too. i have two different extensions attached to my files. I am desperate? does anyone have any solution for decryption? i read somewhere that attaching the hdd to a linux OS computer would help...but it did not say how.

Also got invected and leaves .jzjarof extension on my doc, pdf documents. Tried to use descrptlocker but failed because it says "this file isn't infected by cryptolocker". Can some assist. Levania i think we kind of the same problem. I manage to recover all files on the PC infected using shadows copies but failed on the file server because shadow copies is disabled. I really need those files badly.

Just got infected with CTB locker. Every malware program says they can remove it....but I tried 2 and after scanning.....the CTB virus doesn't even show up. I went to 'ransom' site and theres nothing there either. ANy suggestions ????

Hello, please can someone assist..
i have a computer that has been infected with this ransom-ware. We have removed the virus however all the files are encrypted with the file extension eg. xls.klxfuxe
we tried to use the decryptlocker but failed because the message "this file isn't infected by cryptolocker" comes up, we also tried shadow explorer and that didn't work as well.
please can someone help!!!

@Manolis Tsif
I have the same issue in place. We are the lucky ones - see above:
"It’s not all good news though. There are a number of new variants of CryptoLocker that continue to circulate. Although they operate in a similar fashion to CryptoLocker, there’s no fix for them yet, other than paying the ransom."

I had CTB virus and got rid of it, my files are all there but the virus added an extension for example: resume.DOCX.BPSTDQD I open it and its all these weird characters, I wanted to attach a snip it of it but cant on here

So far, any file I've uploaded to Decryptolocker results in the message ' File does not seem to be infected with Cryptolocker. Please load a Cryptolocker infected file'. Files are definitely encrypted. Office tries to open them but displays the 'File Conversion' window and requests selection of the correct encoding to make the file readable (set to Western European - Windows).

Hi Mathew,
Nice to read from your blog. I got hit with CTB locker virus and the file extensions are something like erdsmbl...I am no computer specalist and just know the amount to operate :0. But I had ALOT of research files of over 8 years, MANY family photos. I was completing some of my books, and all got infected. I didnt make a backup ...which i repent now...
I tried the It fox and fireye site, but my file doesnt load...it says wait for file to load...but hours and hours...doesnt load...
I would appreciate it if anyone can help me this....

Check the bottom-left-hand-corner of the webpage/your browser. You may find that it says;

"Error/Error on page/Page Error" - or words to that effect.

I then had to re-install Firefox - but when trying to upload the files i get the following:

"Invalid file.

The file does not seem to be infected by CryptoLocker. Please submit a CryptoLocker infected file."

I got infected 28/29 April 2015 - even with CryptoPrevent from FoolishIT. But i think i may have been using an outdated version, which i have since updated to v7.4.3 with the Default settings.

Blocked Events Log

13/05/2015 16:39:39

TEST EVENT

Access to C:Documents and SettingsuserApplication DataHelloWorld2.exe has been restricted by your Administrator by location with policy rule {255cdf83-818f-4853-919b-04a034beb6b2} placed on path C:Documents and SettingsuserApplication Data*.exe

29/04/2015 09:43:47

SUSPICIOUS APPLICATION BLOCKED

Access to C:Documents and SettingsuserApplication Datawymvpec.exe has been restricted by your Administrator by location with policy rule {255cdf83-818f-4853-919b-04a034beb6b2} placed on path C:Documents and SettingsuserApplication Data*.exe

28/04/2015 03:08:52

SUSPICIOUS APPLICATION BLOCKED

Access to C:Documents and SettingsuserApplication Datasonrqna.exe has been restricted by your Administrator by location with policy rule {255cdf83-818f-4853-919b-04a034beb6b2} placed on path C:Documents and SettingsuserApplication Data*.exe

Can anyone give me a line by line literal command entry for this? I've been getting errors. I can check for the infected/encrypted files but it won't let me actually decrypt them. I'm getting errors of "Unsuccessful loading key: RSA key format is not supported" and "No Key Files were successfully loaded. Exiting." for any combination I try to load. I'm using a key from a few weeks ago but now when I submit files that are encrypted through the site I keep getting emails apologizing and saying that there isn't a key available. I haven't done anything to the infected files. Any advice? If anyone could email where they see I could be going wrong I would appreciate it. I'm at adamsan41978@yahoo.com. Thank you so much!

Does wiped mean nuked with DBAN or such? If not, PhotoRec might still work. I tried it once and had to stop partway because it was filling a hard drive with a ton of files I didn’t even imagine existed. I was stunned given the capacity of the hard drive where they're coming from.

Another way to get your files back if you are hit with any CryptoLocker malware is to use a program called ShadowExplorer to look into the shadow copies directories which is not hit by the malware and copy the files out onto a formatted hard drive after the actual malware has been removed from the computer using Malwarebytes Chameleon. Only works Windows Vista, & 8 though.

Ran this program a few months back for my girlfriend's laptop, she was getting ticked really fast. Ran SE, saved it to an external drive, installed a Samsung EVO 250 with Win7, programs, protection programs, and Office, all her documents and pictures opened with no issues.

Client's office got hit. They were hit with two incidences of Cryptolocker. Both timers running. It encrypted all workstations, server and the servers only attached external drive backup. The clients thought for sure that they were closing the business. They had 2 other consultants in their office for 2 1/2 days with no success.
I got called in and within 2 days I had their office running, not great but functioning. I set up "loaner server", reconfigured their network, printers etc.
They had to pay the fines because they didn't have access to anything. They paid the 1st one and it took the money but never sent a key. They paid the 2nd time for the other instance running. It took the money but did not issue a key. They waited a week and attempted to get the $$ back. They were lucky and got the funds back but no keys.
We recovered some documents from 2yrs ago from an old Iomega backup image file on tape. The hardware was not working. They had no software for the tape drive and Iomega hardware is not supported anymore.
Set up new network with win 7 Workstations and server 2012R2. Reinstalled apps, Oses, mapped drives, placed the recovered data from old backup onto the server. Well, they were missing a lot but functioning.
Thanks to FireEye and Fox IT!!! We submitted several file samples many did not return a key but then it struck and we got a key.
I ran the tool with the key against the server and workstations hit and it decrypted about 15% of the files and quit. Submitted more file samples and got another key!!! Apparently, it was for the other incidence that was running.
I ran the tool again and it decrypted ALL of the files! Next I had to clean up all of the .bak files. The tool generates a new file for each file recovered. Make sure that you have room on the infected drives. I then merged all the recovered files into the correct folders on the servers data drive. I had quite a bit of cleanup due to older files merging with never ones. File compare software was a great help. We recovered over 500,000 data files. The client is ecstatic. I have gotten several calls from them thanking me for their presents. Every time they look for something "IT'S THERE!" If anyone needs help, shout out and I will do what I can for you.

Client of mine got hit, DropBox, mapped drives, and external HD encrypted.
They chose not to pay the ransom. We reloaded the computer, wiped out everything, even files on their DropBox. Called Carbonite, the folks at Carbonite put together a restore package that restored ALL files that were encrypted. It did take a while to download the files, but when it was all said and done, they were well pleased with their decision to NOT pay the ransom and got to test their contingency plan with Carbonite.

Matthew Hughes is a software developer and writer from Liverpool, England. He is seldom found without a cup of strong black coffee in his hand and absolutely adores his Macbook Pro and his camera. You can read his blog at http://www.matthewhughes.co.uk and follow him on twitter at @matthewhughes.